> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-management/guides/admin/authentication-setup.md).

# Authentication Setup

This guide covers configuring authentication for Rumi Admin.

## Overview

Rumi Admin supports multiple authentication mechanisms through a plugin architecture. Authentication can be configured to use LDAP (delegated to Grafana) or Okta SSO.

## Authentication Plugins

### LDAP

LDAP authentication is handled by Grafana's built-in LDAP support. When enabled, Rumi Admin delegates authentication to Grafana.

To enable LDAP:

1. Set the LDAP configuration in `ecosystem.json`:

   ```json
   {
     "ldap": {
       "enabled": true
     }
   }
   ```
2. Configure Grafana's LDAP settings in the Grafana configuration file (typically `ldap.toml`).

See the [Grafana LDAP documentation](https://grafana.com/docs/grafana/latest/setup-grafana/configure-security/configure-authentication/ldap/) for details on configuring the LDAP connection, bind DN, search filters, and group mappings.

### Okta SSO

Okta authentication uses the `oktajs` library to validate credentials directly against Okta.

To enable Okta:

1. Configure Okta settings in `ecosystem.json`:

   ```json
   {
     "okta": {
       "enabled": true,
       "token": "<your-okta-api-token>",
       "domain": "<your-okta-domain>"
     }
   }
   ```
2. The Admin UI will present a login form that validates credentials against Okta's session API.

A successful authentication creates an active Okta session and grants access to the Admin interface.

## User Management

Rumi Admin stores user settings in a `rumi_users` table in the shared SQLite database:

* **Per-user settings** — Including the `disable_cnc` flag to restrict command-and-control access.
* **Organization membership** — User-to-organization mappings from Grafana's user model.

### Listing Users

Administrators can view all registered users through the Admin API:

```
GET /nvx/users
```

### User Settings

Per-user settings can be managed through the Admin API:

```
GET /nvx/user        # Get current user settings
POST /nvx/user       # Update user settings
DELETE /nvx/user     # Remove user settings
```

## Global Configuration

Global settings that affect all users can be managed through:

```
GET /nvx/config      # Get global config
POST /nvx/config     # Set global config
DELETE /nvx/config   # Remove global config
```

The `global_disable_cnc` setting disables command-and-control for all non-admin users, providing a monitoring-only mode.